Search code examples
http-post.net-4.5windows-authenticationhttp-status-code-401negotiate

HTTP Post and Put returns 401 Unauthorized on specific workstations when authenticating using Negotiate on IIS windows integrated authentication

We have a strange behavior on small amount of workstations (Windows 7). Our .NET client is communicating with REST Api service (Web API 2) which is hosted in IIS. Client uses System.Net.Http.HttpClient to access the Api and is targeted to .NET Framework 4.5.2. Api is configured to use Windows Integrated Authentication (Negotiate, NTLM).

When client calls Api using HTTP GET/DELETE, everything works. When client calls Api using HTTP POST/PUT (data is sent through request body). The IIS responds with 401 Unauthorized.

This problem disappears:

  • when running Fiddler proxy on the client workstation.
  • IIS Authentication is configured to use NTLM only

I went through numerous blog-posts and articles but didn't find a solution.

SignalR shows the same weird behavior. The client also communicates with the service using SignalR. Client can connect to the Hub and receive messages. But gets 401 when trying to invoke a method (signalR call is done using POST). Since the client is on Windows 7, it doesn't support WebSockets. Same behavior is on both transports (Server-sent events, Long polling). It is similar behavior to SignalR net45 gives 401 Unauthorized on specific user/machine combinations. Also the fix (use of Microsoft.AspNet.SignalR.Client.2.2.0\ lib\net40 \Microsoft.AspNet.SignalR.Client.dll) from this post is working as well for SignalR.

Edit: SignalR net40 doesn't use HttpClient from System.Net.Http. So the error must be connected to the System.Net.Http library.

Big thanks for any suggestions.

Solution

  • Possible workaround are:

    • Set System.Net.ServicePointManager.Expect100Continue = false; before creating any instance of HttpClient

    • Disable this 100Continue on HttpClient

      var c = new HttpClient();
c.DefaultRequestHeaders.ExpectContinue = false;